#
# Copyright (C) 2000 - 2024 Silverpeas
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# As a special exception to the terms and conditions of version 3.0 of
# the GPL, you may redistribute this Program in connection with Free/Libre
# Open Source Software ("FLOSS") applications as described in Silverpeas's
# FLOSS exception.  You should have received a copy of the text describing
# the FLOSS exception, and it is also available here:
# "http://www.silverpeas.org/docs/core/legal/floss_exception.html"
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#
x509.TruststoreFile = C:\\Silverpeas\\KMEdition\\Tools\\jboss403\\server\\default\\conf\\server.truststore
x509.TruststorePwd = servercert
x509.DN_OU = silverpeas.com
x509.DN_O = Silverpeas
x509.DN_L = Grenoble
x509.DN_C = FR
x509.Validity = 720
p12.dir = C:\\Silverpeas\\KMEdition\\Tools\\jboss403\\server\\default\\conf\\
p12.salt = SP

# Indicates whether the security mechanisms must be activated.
# If this parameter is set at false, all security parameters are ignored even if they are set to
# true value.
security.web.protection = true
# Indicates whether the SQL injection security mechanism must be activated.
security.web.protection.injection.sql = true
# A REGEXP that permits to identify the parameter names for which the SQL injection verification must be skipped.
# sqlreq is used by connector components which are dealing directly with databases
# editor prefix is used for WYSIWYG
# So, without deactivating entirely the security, it permits to add or remove parameter names to skip from SQL verification
# If no parameters must be skip, please fill no value
security.web.protection.injection.sql.skipped.parameters = (?i)^(editor.*|sqlreq)
# Indicates whether the XSS injection security mechanism must be activated.
# The X-XSS-Protection HTTP header of responses are automatically set at 1 meaning that if a cross-site
# scripting attack is detected, the browser will sanitize the page (remove the unsafe parts).
security.web.protection.injection.xss = true
# A REGEXP that permits to identify the parameter names for which the XSS injection verification must be skipped.
# So, without deactivating entirely the security, it permits to add or remove parameter names to skip from XSS verification
# If no parameters must be skip, please fill no value
security.web.protection.injection.xss.skipped.parameters = (?i)^(editor.*|Content|context)
# Indicates whether the content (and by extension the XSS) injection security mechanism must be
# activated. This property enable the Content Security Policy
# (see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). It enforces the XSS protection
# defined by security.web.protection.injection.xss. This Content Security Policy can be customized
# with the below properties.
security.web.protection.injection.content = true
# Specify the sources of the scripts that will be allowed in Silverpeas other than itself.
# Be cautious that the sources you add can be trusted.
security.web.protection.injection.content.scripts = https://apis.google.com
# Specify the sources of the styles that will be allowed in Silverpeas other than itself.
# Be cautious that the sources you add can be trusted.
security.web.protection.injection.content.styles = https://fonts.googleapis.com
# Indicates whether the security mechanism to protect the web resources must be activated.
# Currently, the security mechanism is based upon the synchronizer token pattern: each request of
# method POST, PUT and DELETE must be stamped with the expected token(s).
security.web.protection.token = true
# Indicates whether the synchronizer token used in the protection of the user session must be
# renewed sometimes?
security.web.protection.sessiontoken.renew = true
# If this parameter is valued, then it means that if Silverpeas is accessed within a secured
# connection, then all HTTP connection attempts will be forbidden and converted by the browser to
# an HTTPS connection.
# The value indicates the time expressed in seconds during which a browser must memorize that
# Silverpeas can be accessed only by HTTPS. By default, one year.
security.web.protection.httpsonly = 31536000
# This parameter is used to handle the Cross-Origin Resource Sharing (CORS).
# By default, no domains is allowed except that of the Silverpeas server itself.
# Setting the parameter to "*" (security.web.protection.domain.allowed = *) to allow all domains.
# In case of restriction, please change the parameter value with allowed domains each one separated by a comma.
# There is no need to add the Silverpeas domain server, it is automatically added in request response by the server.
# Limited allowed domains, for example : "http://www.allowedDomain.com, http://www.otherAllowedDomain.fr"
security.web.protection.domain.allowed =
# When external content is provided (by hyperlink for example) it is done by using iframe with
# sandbox attribute which not allows the external site to access resources of Silverpeas.
# please consult to know possible values: https://developer.mozilla.org/fr/docs/Web/HTML/Element/iframe
# To deactivate sandbox attribute, set deactivated value.
security.external.iframe.sandbox = allow-scripts allow-forms allow-popups allow-orientation-lock

